Multi-Agent Collaboration System Skills

• Analyzed: May 14, 2026, 4:01 AM
• Findings: 1
• Version: 2.0.1
• Hash: 10809a5c783115f6dc73279a8ae0e6289d757de4a460c88afef30acbee34b74b
• Source: palm
• External report: View on VirusTotal

Findings (1)

```json { "classification": "suspicious", "summary": "The skill bundle is classified as suspicious due to a shell injection vulnerability in `scripts/init.sh`. The `sed` command used to replace the project name placeholder (`s/\[项目名称\]/$PROJECT_NAME/g`) directly interpolates user-provided input (`$PROJECT_NAME`) without proper escaping. This could allow an attacker to inject arbitrary shell commands or manipulate the `llms.txt` file if the `project-name` argument contains special characters like `/` or newlines. While the overall purpose of the skill (multi-agent collaboration and document management) appears benign, this vulnerability presents a significant security risk." } ```